I don't have much experience with AWS, but if your main goal is to protect against web-related exploits like XSS, SQL injection, etc., then a web application firewall may be more effective. Snort certainly has rules available for these things, but in my experience a web application firewall will do a better job. This thread has a good explanation on why this is often the case: Using an IPS as an alternative to mod_security
If you are using apache mod_security is the most popular WAF. For DDoS and brute force protection, check out mod_evasive.
Of course Snort does a pretty good job as well and protects against things that WAFs do not, so if the extra resource usage doesn't concern you then I don't think there's any harm in also running Snort as an additional layer of protection.
Ultimately though, the best way to secure a web application is to audit the web site's source code to make sure that these vulnerabilities don't exist in the first place. IDS and web application firewalls are great, but if your site has a vulnerability, a determined attacker will find a way to exploit it.